API supabase #593

dejima-shikou · 2025-02-07T06:31:31Z

PR の目的

APIの認証機能を、firebaseとsupabaseで切り替え可能とする
- 環境変数AUTH_SERVICEにFIREBASEまたはSUPABASEを指定することで切り替わる
  - AUTH_SERVICEは、.envでなく、cocker-composeファイルに定義する
- firebaseとsupabaseの共通ベースクラスAuthModuleにインタフェースを定義することで、差異隠蔽する
docker-compose-test-supabase.ymlにより、APIの自動テストをsupabaseから実行可能にする
- テスト開始時にテスト用ユーザーを登録する仕組みを別タスクで実施するため、本PRではユーザーを手動で登録して動作確認した
- CIは未対応のため、Firebaseで動く
gitがsupabaseのDBデータの変更に反応していたため、無視させる
scriptsについて、vulnrichment2tc.pyで動作確認したところ、Firebaseは正常に動作した。Supabaseはエラーとなるが、優先度が低いため本PRでは対処しない

経緯・意図・意思決定

HTTPAuthorizationCredentials.credentialsを取得する際、
token: HTTPAuthorizationCredentials = Depends(HTTPBearer))
のようにして取得するが、このDependsはルーター関数のDepends、またはそのDependsから呼び出されるDepends、でないとエラーとなる

参考文献

公式　Python Client Library
https://supabase.com/docs/reference/python/introduction

mshim03

大筋は問題ないと思います。細かい点だけコメントしました

mshim03 · 2025-02-07T06:44:49Z

api/app/auth/auth_module.py

+def get_credentials(token: HTTPAuthorizationCredentials = Depends(token_scheme)):
+    return token.credentials


利用していないので、この処理は不要かも？

mshim03 · 2025-02-07T06:48:35Z

api/app/account.py

+
+
+def get_current_user(
+    token: HTTPAuthorizationCredentials = Depends(token_scheme),


HTTPBearer 以外のtoken scheme を使う予定もなさそうなので、DependsでなくてHTTP Bearer決め内でもいいかもしれません

mshim03 · 2025-02-07T06:50:32Z

api/app/main.py


    # Dependency injection as needed
-    app.dependency_overrides[get_firebase_credentials] = lambda: cred
+    app.dependency_overrides[get_auth_module] = override_get_auth_module


以下でもいいかもしれません (わかりにくければ元の方でもいいかなと)

Suggested change

app.dependency_overrides[get_auth_module] = override_get_auth_module

app.dependency_overrides[get_auth_module] = lambda: auth_module

dejima-shikou · 2025-02-12T02:36:11Z

@mshim03
指摘の通り修正しました。

mshim03

HTTPExceptionを返す場所を制限したいので、authmoduleの中で実行するのは避けて欲しいです

mshim03 · 2025-02-18T06:31:30Z

api/app/auth/account.py

+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="No such user",
+        )
+    if user.disabled:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Inactive user",
+        )


router以外で、HTTPExceptionはできれば避けたいが、現状HTTPBearerからトークンを取得して認証するので、HTTP専用の関数となっている。一旦このままでも問題なさそう

mshim03 · 2025-02-18T06:32:53Z

api/app/main.py


    # Dependency injection as needed
-    app.dependency_overrides[get_firebase_credentials] = lambda: cred
+    app.dependency_overrides[get_auth_module] = lambda: auth_module


firebaseのdependency injectionの仕組みを利用

mshim03 · 2025-02-18T06:35:48Z

api/app/auth/firebase_auth_module.py

+        except requests.exceptions.Timeout as firebase_timeout:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Could not validate credentials",
+                headers={"WWW-Authenticate": "Bearer"},
+            ) from firebase_timeout
+
+        data = resp.json()
+        if not resp.ok:
+            error_message = data["error"]["message"]
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=error_message if error_message else "Could not validate credentials",
+                headers={"WWW-Authenticate": "Bearer"},
+            )


ここではHTTPExceptionでなく、Exceptionを発出し、router関数の中 (/token) でHTTPExceptionを返すようにして欲しいです (どこでHTTPExceptionを発行しているのかがわからなくなる)

mshim03 · 2025-02-18T06:36:37Z

api/app/auth/firebase_auth_module.py

+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Could not refresh token",
+                headers={"WWW-Authenticate": "Bearer"},
+            ) from firebase_timeout
+
+        data: dict = resp.json()
+        if not resp.ok:
+            error_message: str = data["error"]["message"]
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=error_message if error_message else "Could not refresh token",
+                headers={"WWW-Authenticate": "Bearer"},
+            )


こちらも同様に、HTTPException をここで発出するのを避けて欲しいです

mshim03 · 2025-02-18T06:37:27Z

api/app/auth/firebase_auth_module.py

+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Token has expired",
+            ) from error
+        except auth.RevokedIdTokenError as error:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Token has revoked",
+            ) from error
+        except auth.CertificateFetchError as error:
+            raise HTTPException(
+                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                detail="Failed to obtain required credentials",
+            ) from error
+        except auth.UserDisabledError as error:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Disabled user",
+            ) from error
+        except (auth.InvalidIdTokenError, ValueError) as error:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Could not validate credentials",
+                headers={"WWW-Authenticate": "Bearer"},
+            ) from error
+


HTTPExceptionについて同様

dejima-shikou · 2025-02-18T07:55:39Z

@mshim03
auth層ではAuthExceptionを投げ、routers層でHTTPExceptionに変換する方式としました

mshim03

typoの修正とディレクトリの変更お願いいたします

mshim03 · 2025-02-18T09:06:13Z

api/app/routers/http_excption_creator.py

+from fastapi import HTTPException, status
+
+from app.auth.auth_exception import AuthErrorType, AuthException
+
+
+def get_status_code(error_type: AuthErrorType):
+    match error_type:
+        case AuthErrorType.UNAUTHORIZED:
+            return status.HTTP_401_UNAUTHORIZED
+        case AuthErrorType.INTERNAL_SERVER_ERROR:
+            return status.HTTP_500_INTERNAL_SERVER_ERROR
+        case AuthErrorType.SERVICE_UNAVAILABLE:
+            return status.HTTP_503_SERVICE_UNAVAILABLE
+
+
+def create_http_excption(auth_exception: AuthException) -> HTTPException:
+    return HTTPException(
+        status_code=get_status_code(auth_exception.error_type),
+        detail=auth_exception.message,
+        headers={"WWW-Authenticate": "Bearer"},
+    )


ルーティングよう関数と同じディレクトリになっているので、 validators 同様に utils/ など別フォルダに入れていただけると助かります

mshim03 · 2025-02-18T09:07:32Z

api/app/routers/http_excption_creator.py

+            return status.HTTP_503_SERVICE_UNAVAILABLE
+
+
+def create_http_excption(auth_exception: AuthException) -> HTTPException:


create_http_exception のtypoのようです

dejima-shikou · 2025-02-18T09:15:00Z

@mshim03
指摘の2件を修正しました。

mshim03

LGTM

change firebase authentication to class

072d591

dejima-shikou had a problem deploying to test February 7, 2025 06:31 — with GitHub Actions Failure

mshim03 reviewed Feb 7, 2025

View reviewed changes

fix auth code

e6d6d9f

dejima-shikou had a problem deploying to test February 12, 2025 02:35 — with GitHub Actions Failure

change auth api

75817ff

dejima-shikou had a problem deploying to test February 12, 2025 04:07 — with GitHub Actions Failure

Merge branch 'main' into topic/api-supabase

8c60a66

dejima-shikou had a problem deploying to test February 14, 2025 03:12 — with GitHub Actions Failure

dejima-shikou added 2 commits February 14, 2025 13:30

add supabase_auth_module

3b222f0

add supabase

6d950a4

dejima-shikou had a problem deploying to test February 14, 2025 04:32 — with GitHub Actions Failure

fix SUPABASE_PUBLIC_URL

380a0ed

dejima-shikou had a problem deploying to test February 14, 2025 05:28 — with GitHub Actions Failure

change url

ca26ad6

dejima-shikou had a problem deploying to test February 14, 2025 06:10 — with GitHub Actions Failure

set network

0a0a931

dejima-shikou had a problem deploying to test February 14, 2025 07:07 — with GitHub Actions Failure

dejima-shikou added 3 commits February 14, 2025 18:22

change how the supabase response is referenced

09f5d49

add AUTH_SERVICE in env

e35ebc6

set TESTDB_HOST in env

693a2ea

dejima-shikou had a problem deploying to test February 14, 2025 09:47 — with GitHub Actions Failure

ignore supabase db data

375dd17

dejima-shikou had a problem deploying to test February 17, 2025 01:14 — with GitHub Actions Failure

add check_token

a2f7c2d

dejima-shikou had a problem deploying to test February 17, 2025 01:20 — with GitHub Actions Failure

change deprecated method

190fcb7

dejima-shikou had a problem deploying to test February 17, 2025 03:07 — with GitHub Actions Failure

fix mypy warning

4444b5d

dejima-shikou had a problem deploying to test February 17, 2025 03:13 — with GitHub Actions Failure

dejima-shikou changed the title ~~change firebase authentication to class~~ API supabase Feb 17, 2025

move account.py

37f83ad

dejima-shikou had a problem deploying to test February 17, 2025 04:36 — with GitHub Actions Failure

fix black error

5f1106b

dejima-shikou had a problem deploying to test February 17, 2025 04:51 — with GitHub Actions Failure

set env AUTH_SERVICE in Pipenv CI

789173a

dejima-shikou temporarily deployed to test February 17, 2025 04:58 — with GitHub Actions Inactive

delete unnecessary comment

239e3f5

dejima-shikou temporarily deployed to test February 17, 2025 07:22 — with GitHub Actions Inactive

delete wrong network

223c0e9

dejima-shikou temporarily deployed to test February 17, 2025 07:27 — with GitHub Actions Inactive

dejima-shikou marked this pull request as ready for review February 18, 2025 06:00

mshim03 requested changes Feb 18, 2025

View reviewed changes

raise HTTPException from routers

03fcdc4

dejima-shikou temporarily deployed to test February 18, 2025 07:55 — with GitHub Actions Inactive

Merge branch 'main' into topic/api-supabase

34af069

dejima-shikou temporarily deployed to test February 18, 2025 08:22 — with GitHub Actions Inactive

mshim03 requested changes Feb 18, 2025

View reviewed changes

move http_excption_creator to utils

f94e0bb

dejima-shikou had a problem deploying to test February 18, 2025 09:14 — with GitHub Actions Failure

put __init__

15cc81e

dejima-shikou temporarily deployed to test February 18, 2025 09:26 — with GitHub Actions Inactive

mshim03 approved these changes Feb 18, 2025

View reviewed changes

mshim03 merged commit 3e80e6b into main Feb 18, 2025
7 checks passed

mshim03 deleted the topic/api-supabase branch February 18, 2025 09:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

API supabase #593

API supabase #593

dejima-shikou commented Feb 7, 2025 •

edited

Loading

mshim03 left a comment

mshim03 Feb 7, 2025

mshim03 Feb 7, 2025

mshim03 Feb 7, 2025

dejima-shikou commented Feb 12, 2025

mshim03 left a comment

mshim03 Feb 18, 2025 •

edited

Loading

mshim03 Feb 18, 2025

mshim03 Feb 18, 2025

mshim03 Feb 18, 2025

mshim03 Feb 18, 2025

dejima-shikou commented Feb 18, 2025

mshim03 left a comment

mshim03 Feb 18, 2025

mshim03 Feb 18, 2025

dejima-shikou commented Feb 18, 2025

mshim03 left a comment

		def get_credentials(token: HTTPAuthorizationCredentials = Depends(token_scheme)):
		return token.credentials



		def get_current_user(
		token: HTTPAuthorizationCredentials = Depends(token_scheme),

	app.dependency_overrides[get_auth_module] = override_get_auth_module
	app.dependency_overrides[get_auth_module] = lambda: auth_module

		return status.HTTP_503_SERVICE_UNAVAILABLE


		def create_http_excption(auth_exception: AuthException) -> HTTPException:

API supabase #593

API supabase #593

Conversation

dejima-shikou commented Feb 7, 2025 • edited Loading

PR の目的

経緯・意図・意思決定

参考文献

mshim03 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dejima-shikou commented Feb 12, 2025

mshim03 left a comment

Choose a reason for hiding this comment

mshim03 Feb 18, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dejima-shikou commented Feb 18, 2025

mshim03 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dejima-shikou commented Feb 18, 2025

mshim03 left a comment

Choose a reason for hiding this comment

dejima-shikou commented Feb 7, 2025 •

edited

Loading

mshim03 Feb 18, 2025 •

edited

Loading